Privacy
Last updated 6 October 2026
What we store, why, and what never leaves your device.
Who we are
HookEye is run by VLADIMIR JANKOV PR VLAJKO JJJ, a sole proprietor (preduzetnik) registered at Titelska 2, Ečka, Serbia (PIB 112515052, MB 66155099). We are the controller of the personal data described here. You can reach us at privacy@hookeye.app.
What stays on your device
The attention model and the scores run in your browser. Your original images are never uploaded: the app makes a smaller copy and works from that. A reel's video stays on the device that analysed it, unless you start a feed test for it (see below).
What we store
| Data | Why |
|---|---|
| Your email address, name and, if you add them, company, Instagram handle and profile picture | To give you an account and show your profile |
| Your password, as a one-way hash (argon2id). We cannot read it | To sign you in |
| If you sign in with Google or Facebook: the identifier and the email address they give us | To sign you in without a password |
| Your projects: name, goal, descriptions, the caption and opening line if you type them, scores and the boxes you draw on an image | To show your results again |
| Files made from your content: a thumbnail, a copy of each image at most 1600 pixels wide, the heatmap, and for a reel its attention maps and six still frames | To show your results on any device and to write the report |
| The written report | To show it to you |
| Your plan, the state of your subscription and how many reports you have used | To apply your plan's limits |
| A count of recent sign-in, sign-up and email requests per email address and per network address, kept for at most an hour | To stop abuse |
| If the app fails on your device, an error report: the error's text and where in our code it happened, the page's address without anything after a question mark, which build of the app it was, your operating system and browser family, whether the model ran on the graphics chip, and your account's identifier if you are signed in. No content of yours is in it | To find and fix faults, such as a phone the model does not run on |
We rely on our contract with you for the account, the projects and the report, and on our legitimate interest in keeping the service secure and working for the abuse counters and the error reports.
Cookies
We set one cookie, which keeps you signed in for up to 30 days. It cannot be read by scripts and is not used to follow you. We set no advertising or analytics cookies.
Who else handles your data
| Company | What it receives |
|---|---|
| Cloudflare | Hosts the service, the database and the stored files. Its Turnstile check on the sign-up and password-reset forms tells people from automated programs |
| OpenAI | When you ask for a written report: the reduced copies or still frames of your content with their heatmaps, the scores, and the project name, goal and descriptions you typed. Not your name or email address |
| Lemon Squeezy | If you buy a plan: it is the seller of record and takes the payment. We never see your card details; we receive the plan and the state of the subscription |
| Resend | Your email address and the short code we send you to confirm it or to reset a password |
| Google, Facebook | Only if you choose to sign in with them |
These companies may process data outside Serbia and outside the European Economic Area, under their own safeguards. We do not sell your data and we do not use your content to train models.
Feed tests
If you start a feed test, the content of that project, and for a reel its video, is uploaded and shown to anyone who opens the test's link, until you close or delete the test.
If you take part in a feed test as a respondent, you need no account. We record how long each item was on your screen, what you tapped, any comment you wrote, the kind of device, its screen size and operating system family, and a random identifier for that one session. We do not record your name, your network address or anything from your camera, and we set no cookie. The owner of the test sees the results and the comments. Some items in the feed are generated with AI.
How long we keep it
Until you delete it. Deleting a project removes its files and its report. Deleting your account, from the Account page, cancels any subscription and removes your profile, projects, files, reports and feed tests. Sign-in sessions end after 30 days without use, and emailed codes after 10 minutes. Error reports are written to our hosting provider's log, which keeps them for up to seven days.
Sharing a report
Nothing of yours is public unless you share it. "Share report" on a project makes a link. Anyone who has that link can see that project's name and goal, its images or still frames with their heatmaps, its scores, the boxes you drew, the caption you typed and the written report, without signing in. They cannot see your name, your email address, your other projects or the context you wrote for the report, and they cannot change anything. The page is kept out of search engines. "Stop sharing" ends the link at once, and so does deleting the project.
Your rights
You can see and correct your profile in the app, and delete your account there at any time. You may also ask us for a copy of your data, ask us to correct or erase it, or object to how we use it; write to us at privacy@hookeye.app. If you think we have handled your data wrongly you can complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, or to the data protection authority where you live.
Children
HookEye is not meant for anyone under 18, and we do not knowingly keep their data.
Changes
If we change this text in a way that matters we will tell you by email or in the app before the change applies.